OpenSSL Heartbleed bug: CVE-2014-0160

[AdamBatey]

Hi,

Just wondering if any Palo Alto versions are affected by this bug in OpenSSL?

http://heartbleed.com/

Regards

[miwright]

Yes, it looks to have just went live. Any reason as to why it was originally pulled and then re-released?

[HULK]

Initially there was an issue, the newly added signature was not visible until the user logout and login again into the GUI.

Thanks

[rgreens]

I have applied it but when we test our websites using Test your server for Heartbleed (CVE-2014-0160) it reports our sites as vulnerable.

[infotech]

So this update can be installed during work hours and not cause any issues to the operation of the PA

[mario11584]

Is that a question? If it is the answer is yes.

[mario11584]

rgreens, mine is doing the same thing still. Is the update not working?

[vickmarkr]

rgreens, Are you seeing the vulnerability signature firing in the Threat Log?  When we try either that website or the Python script that is going around against our websites, I do not see anything in the Threat log after we have applied 429-2164.

[rgreens]

Nothing in the threat log either.

[ericgearhart]

I'm using ssltest.py to test various sites both behind a pair of PA firewalls and internal sites where traffic is monitored by a PA4020 in tap mode only, and I can't get the threat alert to fire off when I test sites. Is anyone else having trouble verifying the threat rule is working?

For reference I'm using ssltest.py from here:

Python Heartbleed (CVE-2014-0160) Proof of Concept

[gafrol]

I was not able to get the signature to fire neither....

[infotech]

Has anyone actually gotten hit by  heartbleed? If so how does it show in the PA etc.

[mss.support]

Is this it?

Threat/Content Name   OpenSSL TLS Heartbeat Information Disclosure Vulnerability

[HULK]

IPS vulnerability signature ID 36416 ("OpenSSL TLS Heartbeat Information Disclosure Vulnerability")

[mss.support]

I think you guys were searching for the wrong thing.  It was there all along

Name

OpenSSL TLS Heartbeat Information Disclosure Vulnerability

ID

36416

Description

OpenSSL is prone to a information leak vulnerability while parsing certain crafted SSL requests. The vulnerability is due to the TLS heartbeat extension failing to properly handle SSL request. An attacker could exploit the vulnerability by sending many crafted SSL requests. A successful attack could lead to leak of the server sensitive information.

Severity

CVE

CVE-2014-0160

Bugtraq ID

Vendor ID

Reference

http://www.openssl.org/news/secadv_20140407.txt

[HWSAdmin]

Me neither.

For good measure, I deleted the existing Threat Definitions and pulled down new ones as I thought perhaps I had originally installed the version that had been pulled by engineering.

Still can't get it to recognize threat hits.

Will this signature/SSL Decoder only work in a situation where the PA is performing decryption?